---
title: "OMI OMIGOD privilege esc (CVE-2021-38648)"
canonical: https://trickest.com/library/cve-2021-38648-omi-omigod-privilege-escalation
description: "Flag Microsoft OMI hosts for CVE-2021-38648 by reading ProductVersion from GET /wsman. Floor 1.6.8-1. No SOAP Identify POST and no PrivEsc."
---

# OMI OMIGOD privilege esc (CVE-2021-38648)

## Overview

This workflow finds Microsoft Open Management Infrastructure (OMI) and sorts each host by whether its ProductVersion falls below the CVE-2021-38648 OMIGOD floor. CVE-2021-38648 is elevation of privilege in OMI on vulnerable builds. This check never posts a SOAP Identify body and never runs a privilege-escalation exploit. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/wsman` only, fingerprints OMI from WS-Man markers such as `ProductVendor` and `ProductVersion`, parses the version, and compares it to floor 1.6.8-1. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no auth-bypass confirm and no second request.

Run it on a schedule when Linux agents turn over. A rebuilt Azure VM image that still ships a pre-1.6.8-1 OMI package is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/wsman` on each host and fingerprint OMI from markers such as `IdentifyResponse`, `ProductVendor`, `Microsoft`, `ProductVersion`, and `wsmid`.
3. Parse `ProductVersion` and compare it to the CVE-2021-38648 floor 1.6.8-1 in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether OMI was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/wsman` only. No SOAP Identify POST and no privilege-escalation exploit.

## Sample output

The records below are illustrative and do not come from a real run. They show one OMI host below the CVE-2021-38648 floor, one at or above it, and one host that is not the product.

```jsonl
{"url": "https://omi.example.com:5986", "is_product": true, "product_version": "1.6.8-0", "vulnerable": true, "detail": "below fixed release 1.6.8-1"}
{"url": "https://omi.example.org:5986", "is_product": true, "product_version": "1.6.8-1", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Microsoft OMI"}
```

```json
{"cve": "CVE-2021-38648", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which OMI versions does this flag?

Builds below floor 1.6.8-1, the single FIXED floor coded in the graph. The compare uses the `ProductVersion` string the `/wsman` response itself served.

### Does an affected row mean OMIGOD privilege escalation ran?

No. The check only GETs `/wsman` and reads `ProductVersion`. It does not post a SOAP Identify request and it does not confirm privilege escalation.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of `/wsman`. It does not log in or escalate privileges.

### Does the check need credentials?

No. It fingerprints the public WS-Man surface the way an external scanner would.

### What is CVE-2021-38648?

OMIGOD elevation of privilege in Microsoft Open Management Infrastructure on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [OMI OMIGOD unauth RCE (CVE-2021-38647)](/library/cve-2021-38647-omi-omigod-unauthenticated-rce). Reach for it when you need the companion unauthenticated RCE fingerprint.
- [Exchange ProxyNotShell SSRF (CVE-2022-41040)](/library/cve-2022-41040-exchange-proxynotshell-ssrf). Reach for it when the next Microsoft management-plane flag is Exchange SSRF.

---
_Markdown source of https://trickest.com/library/cve-2021-38648-omi-omigod-privilege-escalation._